feat: switch auth from password to token for browser persistence

feat: derive dataset name from Space repo name to avoid conflicts

fix: write DNS results to /etc/hosts for undici/fetch compatibility

fix: add Telegram domains to DNS-over-HTTPS pre-resolution

fix: remove leftover _ensure_telegram_credentials() call causing RUNTIME_ERROR

fix: patch config when dataset exists but is empty

feat: auto-derive dataset repo name from HF_TOKEN when AUTO_CREATE_DATASET=true

security: change AUTO_CREATE_DATASET default to false

docs: add detailed env var table with examples, change sync interval to 60s

chore: replace gpt-4o-mini with gpt-5-nano everywhere

chore: default model → openai/gpt-oss-20b:free (OpenAI open-source)

chore: default repo → HuggingClaw-data, default model → DeepSeek V3 (free)

fix: IndentationError in sync_hf.py line 161

Remove Telegram env vars, clean up README and .env.example

feat: add AUTO_CREATE_DATASET env var to control dataset auto-creation

fix: only set NODE_MEMORY_LIMIT when explicitly configured

feat: professional README, .env.example, architecture diagram

fix: ensure password auth is set in all startup paths

feat: switch to password auth + project README

fix: use global variable for token injection (works in incognito iframe)

fix: always overwrite token in localStorage (not only when empty)

fix: set OPENCLAW_VERSION from package.json for correct version display

fix: add dangerouslyDisableDeviceAuth for remote WS connections

fix: use fixed auth token + python-based token injection + restore entrypoint inject

fix: disable auth (mode:none) + patch CSP frame-ancestors for HF iframe embedding

fix: use auth:{} instead of auth:false (object required)

fix: disable gateway auth (HF provides access control), remove token inject hack

fix: move inject-token to runtime entrypoint (build-time injection ignored by OpenClaw)

fix: remove empty apiKey (config invalid), add HF origins to CSP allowedOrigins

perf: node user build (-104s chown), merge RUN layers (-170s), plugin whitelist (-40s)

feat: add timing to all stages, fix OPENROUTER_API_KEY crash, async DNS

deploy: HuggingClaw with original Dockerfile